{"api_version":"1","generated_at":"2026-07-23T10:18:53+00:00","cve":"CVE-2008-3415","urls":{"html":"https://cve.report/CVE-2008-3415","api":"https://cve.report/api/cve/CVE-2008-3415.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-3415","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-3415"},"summary":{"title":"CVE-2008-3415","description":"Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-07-31 17:41:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-22","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://securityreason.com/securityalert/4093","name":"http://securityreason.com/securityalert/4093","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CXSecurity - IDS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/31243","name":"http://secunia.com/advisories/31243","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"CMScout \"bit\" Local File Inclusion Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/30385","name":"http://www.securityfocus.com/bid/30385","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CMScout 'common.php' Local File Include Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44017","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44017","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2218/references","name":"http://www.vupen.com/english/advisories/2008/2218/references","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.cmscout.co.za/index.php?page=news&id=29","name":"http://www.cmscout.co.za/index.php?page=news&id=29","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"cmscout.co.za","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/6142","name":"https://www.exploit-db.com/exploits/6142","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CMScout 2.05 - 'bit' Local File Inclusion - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-3415","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-3415","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"3415","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cmscout","cpe5":"cmscout","cpe6":"2.05","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:37:26.931Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"31243","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31243"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.cmscout.co.za/index.php?page=news&id=29"},{"name":"4093","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/4093"},{"name":"cmscout-common-file-include(44017)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44017"},{"name":"ADV-2008-2218","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2218/references"},{"name":"30385","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/30385"},{"name":"6142","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/6142"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-07-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"31243","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31243"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.cmscout.co.za/index.php?page=news&id=29"},{"name":"4093","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/4093"},{"name":"cmscout-common-file-include(44017)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44017"},{"name":"ADV-2008-2218","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2218/references"},{"name":"30385","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/30385"},{"name":"6142","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/6142"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-3415","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"31243","refsource":"SECUNIA","url":"http://secunia.com/advisories/31243"},{"name":"http://www.cmscout.co.za/index.php?page=news&id=29","refsource":"CONFIRM","url":"http://www.cmscout.co.za/index.php?page=news&id=29"},{"name":"4093","refsource":"SREASON","url":"http://securityreason.com/securityalert/4093"},{"name":"cmscout-common-file-include(44017)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44017"},{"name":"ADV-2008-2218","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2218/references"},{"name":"30385","refsource":"BID","url":"http://www.securityfocus.com/bid/30385"},{"name":"6142","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/6142"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-3415","datePublished":"2008-07-31T17:00:00.000Z","dateReserved":"2008-07-31T00:00:00.000Z","dateUpdated":"2024-08-07T09:37:26.931Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-07-31 17:41:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-22","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cmscout:cmscout:2.05:*:*:*:*:*:*:*","matchCriteriaId":"D153E96F-9743-46E7-AA70-B42531AB9CEE"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"3415","Ordinal":"1","Title":"CVE-2008-3415","CVE":"CVE-2008-3415","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"3415","Ordinal":"1","NoteData":"Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.","Type":"Description","Title":"CVE-2008-3415"},{"CveYear":"2008","CveId":"3415","Ordinal":"2","NoteData":"2008-07-31","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"3415","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}